CVE-2026-33072

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33072", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T19:27:06.344Z", "datePublished": "2026-03-20T08:31:08.452Z", "dateUpdated": "2026-03-20T18:07:22.683Z"}, "containers": {"cna": {"title": "FileRise: Default Encryption Key Enables Token Forgery and Config Decryption", "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "lang": "en", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x"}, {"name": "https://github.com/error311/FileRise/releases/tag/v3.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/error311/FileRise/releases/tag/v3.9.0"}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"version": "< 3.9.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T08:31:08.452Z"}, "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}], "source": {"advisory": "GHSA-f4xx-57cv-mg3x", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-20T16:04:34.650265Z", "id": "CVE-2026-33072", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T18:07:22.683Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33072", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-20T16:04:34.650265Z"}}}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T16:04:52.939Z"}}], "cna": {"title": "FileRise: Default Encryption Key Enables Token Forgery and Config Decryption", "source": {"advisory": "GHSA-f4xx-57cv-mg3x", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "error311", "product": "FileRise", "versions": [{"status": "affected", "version": "< 3.9.0"}]}], "references": [{"url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "name": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/error311/FileRise/releases/tag/v3.9.0", "name": "https://github.com/error311/FileRise/releases/tag/v3.9.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T08:31:08.452Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33072", "state": "PUBLISHED", "dateUpdated": "2026-03-20T18:07:22.683Z", "dateReserved": "2026-03-17T19:27:06.344Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T08:31:08.452Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FileRise", "vendor": "error311", "versions": [{"status": "affected", "version": "< 3.9.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filerise:filerise:*:*:*:*:*:*:*:*", "matchCriteriaId": "AB279A4C-FE56-4D97-9D52-6C316C1B3266", "versionEndExcluding": "3.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FileRise is a self-hosted web file manager / WebDAV server. In versions prior to 3.9.0, a hardcoded default encryption key (default_please_change_this_key) is used for all cryptographic operations \u2014 HMAC token generation, AES config encryption, and session tokens \u2014 allowing any unauthenticated attacker to forge upload tokens for arbitrary file upload to shared folders, and to decrypt admin configuration secrets including OIDC client secrets and SMTP passwords. FileRise uses a single key (PERSISTENT_TOKENS_KEY) for all crypto operations. The default value default_please_change_this_key is hardcoded in two places and used unless the deployer explicitly overrides the environment variable. This issue is fixed in version 3.9.0."}, {"lang": "es", "value": "FileRise es un gestor de archivos web autoalojado / servidor WebDAV. En versiones anteriores a la 3.9.0, se utiliza una clave de cifrado predeterminada codificada de forma r\u00edgida (default_please_change_this_key) para todas las operaciones criptogr\u00e1ficas \u2014 generaci\u00f3n de tokens HMAC, cifrado de configuraci\u00f3n AES y tokens de sesi\u00f3n \u2014 permitiendo a cualquier atacante no autenticado forjar tokens de carga para la subida arbitraria de archivos a carpetas compartidas, y descifrar secretos de configuraci\u00f3n de administrador, incluidos secretos de cliente OIDC y contrase\u00f1as SMTP. FileRise usa una \u00fanica clave (PERSISTENT_TOKENS_KEY) para todas las operaciones criptogr\u00e1ficas. El valor predeterminado default_please_change_this_key est\u00e1 codificado de forma r\u00edgida en dos lugares y se utiliza a menos que el implementador anule expl\u00edcitamente la variable de entorno. Este problema est\u00e1 solucionado en la versi\u00f3n 3.9.0."}], "id": "CVE-2026-33072", "lastModified": "2026-06-17T10:36:54.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33072", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-20T16:04:34.650265Z", "version": "2.0.3"}}]}, "published": "2026-03-20T09:16:15.710", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/error311/FileRise/releases/tag/v3.9.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/error311/FileRise/security/advisories/GHSA-f4xx-57cv-mg3x"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}, {"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FileRise", "source": "cna", "vendor": "error311"}, "product": "filerise", "vendor": "error311"}], "analysis": {"en": {"generated_at": "2026-03-23T18:06:12.760273+00:00", "value": {"mitigation_remediation": ["Update FileRise to version\u202f3.9.0 or later, which removes the hardcoded key.", "If upgrading is not immediately possible, set the PERSISTENT_TOKENS_KEY environment variable to a unique, strong secret to replace the default key.", "Restrict network access to the FileRise management interface to trusted administrators and enable secure authentication.", "Monitor application logs for suspicious upload activity and token verification failures."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Access and Secrets Exposure"}, "threat_synthesis": {"affected_systems": "The flaw affects the FileRise self\u2011hosted web file manager/WebDAV server in all releases earlier than version\u202f3.9.0. Any deployment that has not set the PERSISTENT_TOKENS_KEY environment variable to a unique, strong value remains vulnerable. No other vendors or products are listed as impacted.", "description_and_impact": "FileRise versions before 3.9.0 use a default encryption key (default_please_change_this_key) hardcoded for all cryptographic operations, including HMAC token generation, AES config encryption, and session tokens. Because the key is predictable and not overridden, an attacker can forge upload tokens, allowing arbitrary file uploads to shared folders, and can decrypt administrator configuration, such as OIDC client secrets and SMTP passwords. The weakness represents CWE\u20111188 (Use of Hardcoded Salt) and CWE\u2011798 (Use of Hardcoded Credentials). The impact includes loss of confidentiality and integrity for configuration data and potential unauthorized file placement.", "risk_and_exploitability": "The CVSS score of 8.2 indicates high severity, while the EPSS score of less than 1\u202f% suggests low current exploitation likelihood; FileRise is not in the CISA KEV catalog. Based on the description, the likely attack vector is HTTP based: an unauthenticated attacker crafts requests with forged tokens to upload files. Because the token generation uses the hardcoded key and no authentication is required, remote exploitation is possible without valid credentials, allowing upload of arbitrary files and extraction of sensitive configuration."}}}}, "created": "2026-03-20T10:36:32.012425+00:00", "updated": "2026-03-25T14:29:49.602094+00:00", "vendors": ["error311", "error311$PRODUCT$filerise"]}